The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a wide variety of local project sources, including tracker files, Git state, and decision logs. This creates an attack surface where malicious instructions could be embedded in the project files.
Ingestion points: Identified in SKILL.md (Step 2) and references/project-lens.md, which instruct the agent to read canonical sources, Git state, and task files.
Boundary markers: Present in SKILL.md under the Guardrails section, which requires that "Facts, inferences, and scenarios remain visibly distinct; missing evidence stays unknown."
Capability inventory: The skill uses file reading capabilities and invokes a separate visualize skill to render content.
Sanitization: The references/codex-app.md file includes a verification step requiring the agent to verify literal fragment markup and scoped JavaScript before rendering.
[DYNAMIC_EXECUTION]: The skill generates HTML fragments that include scoped JavaScript to facilitate interactions within the Codex App.
Evidence: references/codex-app.md specifies the creation of a "new HTML fragment in the thread-scoped visualization directory" and includes an example of window.openai.sendFollowUpMessage for conversation context.
Context: This dynamic execution is a core feature of the supported "Codex App" environment and is documented with verification steps to ensure markup safety.

project-control